feat:图片加密忽略面板页面

pjcloud-common/pjcloud-common-core/src/main/java/com/bsd/pjcloud/common/core/file/FileAccessProperties.java

@@ -16,6 +16,7 @@ public class FileAccessProperties implements InitializingBean {
     private boolean blockBrowserNavigation = true;
     private String publicBaseUrl = "";
     private List<String> allowedOrigins = new ArrayList<>();
+    private List<String> publicImageRefererPrefixes = new ArrayList<>();
     private Map<String, Client> clients = new LinkedHashMap<>();
     private LegacyDart legacyDart = new LegacyDart();
     private Upload upload = new Upload();
@@ -72,8 +73,22 @@ public class FileAccessProperties implements InitializingBean {
                 }
             } catch (IllegalArgumentException e) { throw new IllegalStateException("Invalid file-access.public-base-url"); }
         }
+        if (publicImageRefererPrefixes == null) throw new IllegalStateException("Invalid public image Referer prefixes");
+        for (String prefix : publicImageRefererPrefixes) {
+            try {
+                java.net.URI uri = java.net.URI.create(prefix);
+                String path = uri.getRawPath();
+                if (uri.getHost() == null || !("https".equalsIgnoreCase(uri.getScheme()) || "http".equalsIgnoreCase(uri.getScheme()))
+                        || uri.getUserInfo() != null || uri.getRawQuery() != null || uri.getRawFragment() != null
+                        || path == null || path.length() <= 1 || !path.endsWith("/") || path.contains("%")
+                        || !path.equals(uri.normalize().getRawPath())) throw new IllegalArgumentException();
+            } catch (RuntimeException e) { throw new IllegalStateException("Invalid public image Referer prefix"); }
+        }
         if (enforcing()) {
             for (String app : List.of("admin", "h5", "mini", "flutter", "service", "package")) {
+                // Some deployments retain an old H5 and only allow its image Referer prefix.
+                // An omitted H5 key does not authorize other H5 requests.
+                if (app.equals("h5") && !clients.containsKey(app)) continue;
                 Client client = clients.get(app);
                 if (client == null || !client.getActiveKid().matches("[a-zA-Z0-9_-]{1,32}")
                         || !validKey(client.getKeys().get(client.getActiveKid()))) {